BGP Flow Specification (flowspec) rules are carried inside a dedicated BGP address-family (AFI/SAFI 1/133 for IPv4, 2/133 for IPv6). After basic BGP neighbor statements exist, the next mandatory step on an ASR 1000 is to enter the flowspec address-family so that the router can accept, install, and advertise flowspec NLRI. Without the AF configuration, no flowspec attributes can be exchanged and therefore no edge ACLs (class-maps/policy-maps) are generated to block DDoS traffic.

B. The BGP process is already running; creating an additional process is unnecessary for flowspec.

C. A neighbor cannot be activated for flowspec until the flowspec address-family itself is defined.

D. Route-reflector configuration is optional and unrelated to enabling flowspec on a single ASR 1000.

1. Cisco IOS XE BGP Flow Specification for DDoS Mitigation Configuration Guide, “Enabling Flow Specification—address-family ipv4 flowspec”, Step 2 (Cisco ASR 1000); cisco.com (Doc ID 152896), Section “Configuring BGP FlowSpec”.

2. Cisco ASR 1000 Series Aggregation Services Routers Software Configuration Guide, Release 17.x, Chapter “Implementing BGP”, page “Implementing BGP Flow Specification” (states “Enter address-family … flowspec to enable FlowSpec”).

3. RFC 8955: “Dissemination of Flow Specification Rules”, Sec 6 (“Flow specification NLRI is advertised ... in the BGP Flow Specification address family”).